Texas Executive Order GA-48

Critical infrastructure is defined as a communication infrastructure system, cybersecurity system, IT infrastructure, electric grid system, hazardous waste treatment system, or water treatment facility. Texas Business & Commerce Code, section 117.001(2).

Communication infrastructure could include groupware, email, project management software, fax, phone, teleconferencing systems, and document management systems.

In general, terms an IT infrastructure could include:

• Hardware: Servers, computers, network devices, storage systems, and peripheral devices
• Software: Operating systems applications, databases, Virtualization, and other software programs that enable various functionalities within the infrastructure.
• Networks: Networking components such as routers, switches, firewalls, and cables that connect devices and facilitate data transmission across the infrastructure.
• Data Centers: Centralized facilities that house servers, storage systems, and networking equipment. The data center provides a controlled environments with power, cooling, and security features to ensure optimal performance and data protection.
• Cloud Systems: Cloud computing services, including Infrastructure as a Service (Iaas), Platform as a Service (Paas), and Software as a Service (SaaS), offer scalable and flexible solutions for infrastructure requirements.
• Security Systems: Infrastructure security measures like firewalls, antivirus software, intrusion detection systems, and encryption technologies protect against unauthorized access, data breaches, and cyber threats.
• IT Service Management (ITSM): ITSM frameworks and tools enable efficient management of IT services, including incident management, change management, problem management, and service desk support.
• Cybersecurity System: Cybersecurity refers to any technologies, practices, and policies for preventing cyberattacks or mitigating their impact. Cybersecurity aims to protect computer systems, applications, devices, data, financial assets and people against ransomware and other malware, phishing scams, data theft and other cyberthreats.

Faculty and staff traveling for personal reasons to any country listed as a foreign adversary must complete the MSU Pre-Travel Notification prior to travel and submit to Human Resources.

Faculty and staff who have traveled to foreign adversary countries must complete a Post-Travel Brief and submit to Human Resources no later than seven (7) days after returning from the trip. The Post-Travel Brief will be sent via email upon completion of the Pre-Travel Notice.

A covered agency or public institution of higher education cannot enter into a new contract, contract extension, or contract renewal for a good or service with any company, its holding companies, or subsidiaries if they are:

1. Listed in Section 889 of the 2019 National Defense Authorization Act (NDAA); or
2. Listed in Section 1260H of the 2021 NDAA; or
3. Owned by the government of a country on the U.S. Department of Commerce's foreign adversaries list under 15 C.F.R. § 791.4; or
4. Controlled by any governing or regulatory body located in a country on the U.S. Department of Commerce's foreign adversaries list under 15 C.F.R. § 791.4.

If an employee is aware of an existing contract that meets one of these restrictions, they must contact University Purchasing & Contract Management, which will coordinate a review.

This review will consider whether MSU Texas can continue to use the vendor, what options exist to obtain the good or service from a different company, or if a different service is explored to meet the need if it is mission critical to the organization.

Successful bidders of good or services will be required to certify to the following:

Respondent certifies that pursuant to Executive Order GA-48, respondent is not and, if applicable, none of its companies or subsidiaries are

1. listed in Section 889 of the 2019 National Defense Authorization Act ("NDAA");
2. listed in 1260H of the 2021 NDAA;
3. owned by the government of a country on the U.S. surveillance Department of Commerce's foreign adversaries list under 15 C.F.R. § 791.4 ("15 C.F.R. § 791.4"); or
4. controlled by any governing body located in a country on the 15 C.F.R. § 791.4 List.

To the extent that Executive Order GA-48 is applicable to this Agreement, [CONTRACTING PARTY] is not and, if applicable, none of its holding companies or subsidiaries are

1. listed in Section 889 of the 2019 National Defense Authorization Act ("NDAA");
2. listed in Section 1260H of the 2021 NDAA;
3. owned by the government of a country on the U.S. Department of Commerce's foreign adversaries list under 15 C.F.R. § 791.4 ("15 C.F.R. § 791.4" List); or
4. controlled by any governing body located in a country on the 15 C.F.R. § 791.4 List. 

The following MSU Texas Operating Polices have been revised in accordance with GA-48.

• MSU OP: 14.10: Foreign Sources and Transaction Reporting
• MSU OP: 30.01: Approval and Execution of University Contracts
• MSU OP: 32.04: Disclosure of Certain Gifts from Foreign Persons
• MSU OP: 52.20: Ethics Policy for Employees of Midwestern State University

MSU Texas must include in the minimum job qualifications of the job descriptions of all positions that research, work on, or have access to critical infrastructure as defined in Section 113.001.(2), Business and Commerce Code, that a requirement to be hired and to continue to be employed in that position is the ability to maintain the security or integrity of the infrastructure. Applicable positions which will be reviewed for this job description change include employees working within information technology, cybersecurity, telecommunications, utilities, EHS, facilities, water treatment, electrical grid, and hazardous waste management.

Further, all the above-described applicable personnel, and similarly situated state contractors, must be routinely reviewed to determine whether or not things such as criminal history or continuous connections to the government or political apparatus of a foreign adversary that might prevent the applicant, employee, or contractor from being able to maintain the security or integrity of the infrastructure.